ABSTRACT 

Provided is a content distribution system that 
prevents different keys to be derived between an encryption 
apparatus and a decryption apparatus. A random- number 
generating unit 112d, in an encryption apparatus llOd, 
generates a random number s, and a first function unit 113d 
generates a functional value G(s) of the random number s, 
and generates a verification value a and a shared key K 
from the functional value G(s) . An encryption unit 114d 
generates a first cipher text cl of the verification value 
a using a public-key polynomial h, and a second function 
unit 115d generates a functional value H(a,cl) of the 
verification value a and the first cipher text cl, and a 
random-number mask unit 116d generates a second cipher text 
c2 = s xor H(a,cl) • A decryption unit 123d, in a decryption 
apparatus 120d, decrypts the first cipher text cl using 
a secret-key polynomial f, to generate a decryption 
verification value a' . A third function unit 124d generates 
a functional value H (a' , cl ) of the decryption verification 
value a' and the first cipher text cl, and a random- number 
mask removal unit 125d generates a decryption random number 
s' =c2 xorH(a',cl).. A fourth function unit 12 6d generates 
a hash functional value G ( s' ) of the decryption random number 
s' , and generates a verification value a'' and a shared 
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key K' from the functional value G(s' ) . A comparison unit 
1 2 7d outputs the shared key K' if the decryption verification 
value a' is equal to the verification value a' ' . 
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